Thursday, 30 July 2026

After the Hugging Face incident and the 'Pacing the Frontier' letter — 1,000+ frontier-lab employees call for coordinated slowdown, Altman pauses training — Cloudflare deploys the first production post-quantum authentication to origin servers and a researcher discovers a self-replicating prompt injection worm in Microsoft Word's Copilot

Engineering

Cloudflare Blog

Cloudflare Ships Post-Quantum Authentication to Origin Servers

Cloudflare has crossed the first milestone on its 2029 post-quantum roadmap: its Authenticated Origin Pulls and Custom Origin Trust Store products now accept ML-DSA (Module-Lattice-Based Digital Signature Algorithm, FIPS 204) certificates, enabling fully post-quantum mutually authenticated TLS on the Cloudflare-to-origin leg of a request — distinct from the post-quantum encryption on that same connection that's been live since 2023. The engineering story is honest in its difficulty: Cloudflare's Pingora Origin service had not tracked upstream BoringSSL for four years, maintaining an internal fork instead, and when they finally caught up to incorporate the April 2026 ML-DSA support, the upgrade tightened KeyUsage enforcement and caused a customer-facing incident before a targeted patch restored backward compatibility with technically non-compliant RSA certificates. On the control plane, Go's standard X.509 library does not yet support ML-DSA, requiring Cloudflare to patch in support via its CIRCL library — a burden that Go 1.27, expected August 2026, will lift with native ML-DSA support. The practical implication for operators: origin servers using Full (strict) TLS mode can now negotiate a fully post-quantum-secure channel, closing the authentication gap that encryption-only post-quantum connections had left open — important because a quantum computer capable of forging classical credentials is a distinct and near-term risk from the harvest-now/decrypt-later threat that encryption addresses.

Read →

Simon Willison

Self-Replicating Prompt Injection Worm in Microsoft Word's Copilot

Researcher Håkon Måløy has demonstrated the first prompt injection attack against Microsoft Word's Copilot that deliberately self-replicates into generated documents. The attack chain: an attacker embeds hidden instructions — using white-on-white text, already familiar from AI-assisted job applications — in a source document. When Copilot processes that document, it interprets the instructions as user intent, acts on them (potentially manipulating the document being drafted), and copies the instructions into the output document, turning it into a new carrier. Each downstream document can trigger the attack again in any subsequent Copilot-assisted workflow, propagating the payload without the original attacker's document ever being present again. Microsoft received responsible disclosure 144 days before publication; Willison notes there is still no mitigation covering the full class of attack. The structural difficulty is familiar from other prompt injection research: the attack surface is the generative behavior of the model itself rather than a discrete code path, which means mitigations tend to be narrow and the underlying class of vulnerability remains open. For anyone building AI-assisted document workflows, the implication is that the trust boundary is now the document — any untrusted document processed as source material is a potential instruction-injection vector.

Read →

A Few Thoughts on Cryptographic Engineering (Matthew Green)

Anthropic's Cryptanalysis Results, Assessed by a Cryptographer

Matthew Green (Johns Hopkins) provides the specific, skeptical technical read that Anthropic's own announcement of its Claude Mythos cryptanalysis results notably lacked. On the HAWK attack (targeting the Module-Lattice Isomorphism Problem, a post-quantum signature scheme): the result demonstrates practical key recovery — a real break of a real scheme under active consideration for standardization, and it matters. On the AES 7-round attack: the parameters (2^105 chosen plaintexts, 2^89 computational cost) make the attack entirely impractical and only marginally better than a 2013 result, positioning it as incremental at best. Green's broader methodological point is that AI-generated cryptanalytic outputs require human expert verification, and that the difficulty of that verification is itself a hidden cost not reflected in compute-hours spent. He frames the timing as genuinely fortunate — post-quantum standardization is live and contested right now, and we're in Matthew Green's own framing 'the perfect moment for a massive new public cryptanalysis capability to come online': if AI cryptanalysis can stress-test the algorithms we're adopting before they're deployed at scale, that's a real public good even if individual results need careful expert scrutiny.

Read →

GitHub / Hacker News

Running Gemma 4 26B on 2 GB of RAM by Streaming Experts from SSD

TurboFieldfare is an open-source Swift and Metal inference engine that runs Google's Gemma 4 26B mixture-of-experts model on any M-series Mac using only ~2 GB of RAM — an unusual constraint given that the model's 4-bit quantized weights occupy roughly 14 GB and conventional inference tools require most of that in memory at once. The architecture keeps only the 1.35 GB shared components (embeddings, attention, non-expert layers) and a small expert cache in DRAM, streaming the routed expert weights on demand from SSD via bounded parallel `pread` calls; the GPU processes the shared parts of each layer while SSD reads for the next round of experts are in flight. On consumer hardware this yields practical speeds: 5–6 tokens/second on an 8 GB M2 MacBook Air and 31–35 tokens/second on an M5 Pro. The project ships a native macOS app, a CLI, and an OpenAI-compatible server with streaming and tool-call support. That it collected 791 Hacker News points within hours reflects the broader engineering interest in inference architectures that treat SSD as a memory tier rather than a bottleneck — a design space that matters increasingly as model weights persistently outrun the DRAM budget of consumer and edge hardware.

Read →

frantic.im

The Productivity Mirage

A short essay arguing that optimizing productivity tools and workflows is largely a distraction from the more important variable: whether what you're building is worth building at all. The anchor example is a legendary Facebook engineer ('Bob') who shipped consistently superior work with a near-default development environment, not because setup doesn't matter but because Bob had strong intuitions about which problems deserved to exist — and that capacity for product judgment dominated everything else. The author frames the social-media cycling through new productivity methodologies as productive-feeling procrastination: it delivers the sensation of improvement without forcing the harder question of problem selection. The essay is a useful corrective for engineering teams auditing whether investment in tooling and process is improving outcomes or substituting for the harder work of deciding what to optimize toward.

Read →

Marginal Revolution

Reforming the PhD: Industry Embedded Research Doctorates

The White House and NSF have announced a $47 million pilot to fund roughly 250 four-year technical doctorates in which students spend at least one year embedded at a corporate partner conducting practical research that can count toward their dissertation — 31 universities and over 20 companies, launching fall 2026, with NSF covering three years and institutions plus industry covering the rest. The rationale from OSTP director Michael Kratsios is that the research ecosystem has already shifted: 'about the same amount of basic research is done today in academia as in the private sector,' but PhD training structures haven't moved with it. The administration frames the program as a scalable model relative to the 45,000+ science and engineering doctorates awarded annually. The design raises real questions about intellectual property, advisor incentives, and whether the mandatory corporate placement will channel students toward near-term applied problems at the expense of the basic-science work that industry has historically underproduced — which, if true, would undercut the program's own rationale. The attempt is also notable as a relatively direct structural intervention in academic research norms at a moment when the frontier of technical capability is visibly moving faster inside frontier labs than in universities.

Read →

Works in Progress

Beauty In My Backyard: Aesthetics, Not Just Exclusion, Shaped Conservation Policy

Samuel Hughes proposes a revisionist account of how conservation and heritage-protection movements became powerful: not primarily through economic self-interest (property owners preserving local amenity values) but through widespread aesthetic perception and a specific historical shock. The distinguishing evidence is awkward for standard NIMBY theories: heritage protection emerged in Europe before 1914, decades before modernist architecture became dominant in the 1950s; it concentrates on city centers and working-class housing rather than the affluent suburbs that economic-exclusion accounts would predict; and it requires explaining 'NITBYs' — distant observers with no local economic stake who nonetheless organized against development. Hughes's thesis is that modernism's deep aesthetic unpopularity — its abandonment of ornament, its exposed concrete — changed what redevelopment looked like to the public: it shifted the default framing from 'improvement' to 'uglification,' mobilizing a constituency far wider than neighborhood self-interest could have assembled. For housing reformers, the implication is uncomfortable: the primary obstacle to new supply may be less about organized economic interests than about architecture's failure to maintain public trust — a problem that more permissive zoning alone cannot solve.

Read →

Humanities

JSTOR Daily

The Peacock Flower and the Production of Scientific Ignorance

Historian Londa Schiebinger's research on the peacock flower (Barbados Pride, Caesalpinia pulcherrima) offers a case study in what she terms agnotology — the study of how ignorance is actively produced rather than simply being an absence of knowledge. European naturalists across Suriname, Jamaica, Saint-Domingue, and Barbados all documented enslaved and Indigenous women's use of the plant as an abortifacient: Maria Sibylla Merian, in Suriname in 1699, explicitly situated the practice within the colonial struggle — 'so that their children will not become slaves like they are' — while Hans Sloane in Jamaica framed the same practice as evidence of feminine trickery, and Michel Descourtilz in Saint-Domingue condemned the 'ill intentions' of enslaved women who refused to bear children. Despite this multi-island documentation, the peacock flower's abortifacient properties never entered European botanical or medical traditions. Schiebinger attributes the exclusion to 'cultivated indifference': pronatalist European state policies and plantation societies' growing dependence on enslaved women's reproduction — as the transatlantic slave trade faced restriction — made knowledge that limited fertility actively inconvenient. The case is a concrete demonstration of how the same forces that expanded scientific knowledge in the age of empire simultaneously contracted it wherever expansion threatened the economic logic of empire, and how gaps in the scientific record can reveal the cultural and political priorities of a dominant society as plainly as what the record contains.

Read →

The 'Pacing the Frontier' Governance Moment, Mapped